I am trying to authenticate to the Jazz server using pure Javascript. I am supposed to be able to do a GET on https://myserver:9444/qm/authenticated/j_security_check?j_username=foo&j_password=bar . (same behavior on a POST as well)

This works fine in Ff plugin Poster - if I provide a dummy user-agent header. However, in the JS code I am writing (using dojo.xhrGet), I am getting a 400 - bad request, mostly because the heager is saying Chrome, with a response HTML stating - You have followed a direct link to log in to a Jazz server. This page has been presented to ensure that a malicious website cannot use cleverly crafted content to circumvent security. If you would like to log in to the server, please use the link below.

The problem I have hit is - I am unable to override the user-agent header in teh dojo.xhrGet since it s a protected header and you get a Refused to set unsafe header "user-agent if you try to override it with some value like "api".